Getting Started
This guide walks through installing Groundskeeper and completing the first-run setup wizard. The whole process takes a few minutes, and you can change anything later from Settings.
Before you start, Groundskeeper is built to be safe by default:
- All data stays on your network -- nothing is stored externally.
- Every connection is read-only -- Groundskeeper never changes anything on the systems it monitors.
- You can skip any step in setup and come back to it later.
- Operating system: Windows Server 2022, the platform Groundskeeper is built and tested on (domain-joined recommended for the Active Directory and Windows Server connectors), or Windows 10/11 version 1809 or later for evaluation.
- Hardware: 8 cores / 16 GB RAM recommended. A CPU-only VM is sufficient for most connectors; local AI summaries run more comfortably with more RAM (see AI Features). Bare minimum is 8 GB RAM.
- Disk: ~2 GB free. Python is bundled in the installer -- there is no separate Python install to manage.
-
Network: outbound HTTPS to the cloud services you want to monitor
(Meraki, Microsoft 365 / Graph, Action1, Veeam, etc.) and to
api.rsjsoftware.comfor licence activation. No inbound access is required. - Permissions: Administrator rights to install (it runs as a Windows service).
Download the latest GroundskeeperSetup.exe from the
Releases page.
The release also includes RSJAgentSetup.exe -- the RSJ Agent, the optional
endpoint agent for per-device monitoring. Groundskeeper carries it too, so you
can deploy it from Agent Settings or via Group Policy. You don't need it to
get started; the main installer is all that's required for the server.
What to expect: two security prompts that are normal. Groundskeeper isn't yet from a code-signed publisher, so Windows SmartScreen will likely show "Windows protected your PC" the first time you run the installer -- click More info, then Run anyway. A second warning, about the dashboard's certificate, comes later in this step and is explained below. Neither means anything is wrong; both are expected for a self-hosted tool that isn't (yet) signed or on the public internet. Each GitHub release also lists a SHA-256 checksum for both installers if you want to verify your download first.
Run GroundskeeperSetup.exe as Administrator and follow the wizard. It will:
- Install Groundskeeper to
C:\Program Files\RSJ Software\Groundskeeper - Register and start the Groundskeeper Windows service (it starts automatically on boot from now on)
- Open your browser to the first-run setup wizard
Groundskeeper serves its dashboard over HTTPS on port 8443 by default, using a
self-signed certificate generated at install time. On the server itself the
dashboard is at https://localhost:8443. From another machine, use
https://<server-address>:8443.
Note on the certificate: because the certificate is self-signed, the first time you open the dashboard your browser will show a security warning. This is expected for a self-hosted tool on your own network. To remove the warning on managed devices, the installer includes
tools\Trust-GroundskeeperCert.ps1, which can be pushed via Group Policy to trust the certificate estate-wide. See Troubleshooting & FAQ.
The first time you open the dashboard, Groundskeeper asks you to create an admin password. This protects the dashboard and all API endpoints.
Keep it safe. There is no self-service password reset -- recovery means removing the stored password hash from
config.yamlon the server and restarting the service. See Troubleshooting & FAQ.
With the password set, you'll see the five-step setup wizard. Each step is optional and reversible -- anything you skip can be configured later from Settings.
The opening screen confirms the safety model (data stays local, read-only connections, skip-and-return). Click Get started to begin.
Groundskeeper can produce plain-English summaries of your IT status. AI is optional and off until you choose a provider. You can pick:
- Ollama (local) -- runs entirely on the server, no data leaves your network, free. Recommended for most schools. Needs ~8 GB RAM.
- A cloud provider (Azure OpenAI, Anthropic Claude) -- more capable, but data is sent to that provider. If you choose cloud, prefer a UK/EU region for data residency.
- None -- skip AI entirely. The dashboard, alerts and SLT view all work fully without it.
See AI Features for the full comparison.
Connectors are how Groundskeeper reads from the systems you already run -- Meraki, M365, Veeam, your MIS, domain security, and more. Pick the ones relevant to your school now; you can add the rest any time.
Every connector is read-only and most just need an API key or a hostname. See Connectors for setup details for each one.
On the free Community edition you can enable up to 5 connectors. Pro lifts that limit.
Here you enter the details for the connectors you enabled -- API keys, hostnames, and similar. Each field has inline help explaining where to find the value in the source system.
The final step confirms setup is complete and takes you to the dashboard.
Groundskeeper needs a licence key to run. The free Community key is requested from within the dashboard:
- On first load, the dashboard shows a key request banner.
- Enter your name, email, school name, and your school URN (or your trust's Group UID). Groundskeeper looks the identifier up to confirm your school.
- Submit the request. Your Community key is emailed to you, usually within one business day, and Groundskeeper activates it automatically.
If you already have a key (for example you're reinstalling, or upgrading from Community to Pro), use Settings > Licence to paste it in directly -- there's an "Already have a key?" link on the banner for exactly this.
Running a Multi-Academy Trust? The banner also has a Groundskeeper Central enquiry option -- enter your Group UID and we'll be in touch to arrange a Central licence.
Once a key is active and at least one connector is configured, the dashboard begins populating as connectors run their first checks (this can take a few minutes depending on which connectors are enabled). From here you might want to:
- Set up the SLT Dashboard traffic-light view for leadership
- Add more Connectors
- Configure AI Features if you skipped them in setup
- Read Backup & Restore to protect your configuration
- Use the search box above the dashboard's activity feed to find every event mentioning a device or a word, and Export CSV (on the feed, and on the Devices page) when a governor or insurer wants a spreadsheet
Stuck on anything? See Troubleshooting & FAQ or ask in Discussions.
Last updated: 2026-09-24 (v0.183.1)